Security researchers at Zimperium identified 40 new variants of the TrickMo Android banking trojan deployed across 16 distinct droppers. The malware evades automated static detection by weaponizing malformed ZIP archive structures within malicious APK containers, exploiting parser differentials to bypass antivirus unpacking engines. Once deployed under the guise of legitimate system utilities, TrickMo abuses the Android Accessibility Service to grant itself persistent background permissions, suppress system alerts, and intercept real-time input.

The campaign introduces an HTML-based full-screen overlay mimicking the native Android keyguard to capture user PINs and unlock patterns. By exfiltrating lock credentials alongside device telemetry to command-and-control servers, threat actors execute automated On-Device Fraud (ODF) through remote media projection and VNC sessions, unlocking unattended handsets to transfer funds and hijack SMS one-time passwords. Telemetry from exposed C2 infrastructure revealed over 13,000 compromised IP addresses spanning Germany, Canada, Turkey, and the UAE.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Capturing native keyguard credentials via Accessibility-driven overlay injection allows adversaries to bypass biometric lockouts and hardware keystore protections, turning compromised handsets into interactive proxies capable of unattended on-device fraud.
• Bullet 2 — Strategic & Defender Imperative: Financial institutions and enterprises must implement behavioral telemetry to detect abnormal Accessibility Service entitlements, enforce root and sideloading restrictions via mobile device management, and flag anomalous out-of-band transaction flows.